CVE-2026-38725
Received Received - Intake

Stored XSS in XipBlog Module for PrestaShop

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: MITRE

Description
xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting in Stored Cross-Site Scripting (XSS). When an administrator reviews comments in the back office, the payload executes with admin-level session context, leading to full store compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-29
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-38725
EUVD
EUVD-2026-67768

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
xipblog xipblog_module to 2.0.1 (exc)
prestashop prestashop *
xpert-idea xipblog to 2.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the xipblog module v2.0.1 and earlier for PrestaShop. Attackers can inject malicious JavaScript via the name and content parameters in ajax.php without authentication. The injected script is stored in the database and later rendered in Smarty templates without proper output escaping.

Detection Guidance

Check for the xipblog module version 2.0.1 or earlier in your PrestaShop installation. Inspect network traffic for requests to ajax.php with name and content parameters containing suspicious JavaScript payloads. Review database entries for unsanitized HTML in blog comments or related fields.

Impact Analysis

An attacker could execute arbitrary JavaScript in the context of an administrator's session. When an admin reviews comments in the back office, the payload runs with admin privileges, potentially leading to full compromise of the PrestaShop store, including theft of sensitive data or further malware injection.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, triggering legal penalties, fines, or compliance violations for affected organizations.

Mitigation Strategies

Upgrade the xipblog module to the latest version beyond 2.0.1. Apply input validation and output escaping in the module code. Sanitize HTML in stored data and ensure Smarty templates escape dynamic content. Remove or disable the module if no update is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-38725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart